XF 2.2 Hard delete a user

[Pew Pew]

I have a forum where I need to hard delete users, i.e. remove them from the database entirely. Sure, I can delete it from the admin panel and their posts using an add-on from Andy, as well as their conversations and reactions from the admin panel. However, I am required to remove their data from the entire database.

What records in the database do I have to remove in order to hard delete a user after I delete their posts, conversations, and reactions? Is removing them from xf_user table enough?

 

[Mr Lucky]

I am required to remove their data from the entire database.

What other data (belonging to a deleted user) might there be after deleting the user account, posts, conversations. When you ask is removing from the table enough, it's hard to know without explaining "enough for what?"

I never hard delete accounts any more due to the difficulty of reinstating if they change their mind. I just anonymise and disable the account which means, to all intents and purposes, the user has been deleted.

 

[Old Nick]

Legally speaking, hiding a user's data is not considered deletion.

For members who request the deletion of their data and who change their mind a few weeks or months later, it would be a pleasure to inform them that their wish has been granted and that therefore it is not possible to restore their data. And besides, some clever litigators could even make you believe that they want to recover their account and if you comply with their request they will tell you: "Ah! You didn't delete my data then!!"

 

[Mr Lucky]

Legally speaking, hiding a user's data is not considered deletion.

I wouldn't just hide their data if I anonymise an account - I delete it all so that all that remains is a user ID number and a disabled account that has a different username. There is no trace of them.

If a member does request deletion I ask then if there is any personally identifiable info in any of their posts so that I can also delete those. For example if they were had posted a street address, photo of their house and or family, email address, phone number.

 

[Suzanne O]

Legally speaking, hiding a user's data is not considered deletion.

For members who request the deletion of their data and who change their mind a few weeks or months later, it would be a pleasure to inform them that their wish has been granted and that therefore it is not possible to restore their data. And besides, some clever litigators could even make you believe that they want to recover their account and if you comply with their request they will tell you: "Ah! You didn't delete my data then!!"

Think it maybe a legal thing called GDPR

General Data Protection Regulation (GDPR) – Legal Text

The official PDF of the Regulation (EU) 2016/679 – known as GDPR – its recitals & key issues as a neatly arranged website.

gdpr-info.eu

 

[Mr Lucky]

For members who request the deletion of their data and who change their mind a few weeks or months later, it would be a pleasure to inform them that their wish has been granted and that therefore it is not possible to restore their data.

The thing is everyone makes mistakes so I would be a bit more lenient, especially if that user is actually a good contributing member.

And besides, some clever litigators could even make you believe that they want to recover their account and if you comply with their request they will tell you: "Ah! You didn't delete my data then!!"

I They wouldn't say that because I would not be able to put their data back because it would have been deleted. They will have to do that themselves.

I said I would not delete the account, not that I would not delete their data. ie their profile details, DOB, sex, email, IP address, location and other stuff they have put in their profile plus, if they can identify them, any posts with personally identifying content. That is above and beyond my legal requirements after anonymising the account.

 

[Old Nick]

The thing is everyone makes mistakes so I would be a bit more lenient, especially if that user is actually a good contributing member.

In my mind, a user who requests that their data be deleted is a user with whom there is a conflict, with the staff or certain members. I didn't imagine that a good contributor could do this.

 

[Pew Pew]

I am required to hard delete users, no matter what the law is... We are getting users out of our databases.

So, @Old Nick what do you think needs to be removed so that a user is considered hard deleted?